From: Dariusz Sosnowski <dsosnowski@nvidia.com>
To: Viacheslav Ovsiienko <viacheslavo@nvidia.com>,
Bing Zhao <bingz@nvidia.com>, Ori Kam <orika@nvidia.com>,
Suanming Mou <suanmingm@nvidia.com>,
Matan Azrad <matan@nvidia.com>,
Alexander Kozyrev <akozyrev@nvidia.com>
Cc: <dev@dpdk.org>, Kiran Vedere <kiranv@nvidia.com>, <stable@dpdk.org>
Subject: [PATCH] net/mlx5: fix uninitialized skip count
Date: Fri, 15 May 2026 14:33:58 +0200 [thread overview]
Message-ID: <20260515123358.354191-1-dsosnowski@nvidia.com> (raw)
From: Kiran Vedere <kiranv@nvidia.com>
mlx5_rx_poll_len() may return MLX5_ERROR_CQE_MASK when
mlx5_rx_err_handle() reports MLX5_CQE_STATUS_HW_OWN while the Rx queue
is in IGNORE error state. In this HW_OWN case mlx5_rx_err_handle()
does not necessarily write to *skip_cnt, yet the caller (mlx5_rx_burst)
unconditionally uses skip_cnt to advance rq_ci.
This can cause rq_ci to jump by an undefined value, desynchronizing the
RQ and CQ rings and leading to persistent bad packet delivery until the
queue is reset.
Fixes: aa67ed308458 ("net/mlx5: ignore non-critical syndromes for Rx queue")
Cc: akozyrev@nvidia.com
Cc: stable@dpdk.org
Signed-off-by: Kiran Vedere <kiranv@nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
---
drivers/net/mlx5/mlx5_rx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/mlx5/mlx5_rx.c b/drivers/net/mlx5/mlx5_rx.c
index 185bfd4fff..09cd3f1ffb 100644
--- a/drivers/net/mlx5/mlx5_rx.c
+++ b/drivers/net/mlx5/mlx5_rx.c
@@ -1051,7 +1051,7 @@ mlx5_rx_burst(void *dpdk_rxq, struct rte_mbuf **pkts, uint16_t pkts_n)
int len = 0; /* keep its value across iterations. */
while (pkts_n) {
- uint16_t skip_cnt;
+ uint16_t skip_cnt = 0;
unsigned int idx = rq_ci & wqe_mask;
volatile struct mlx5_wqe_data_seg *wqe =
&((volatile struct mlx5_wqe_data_seg *)rxq->wqes)[idx];
@@ -1497,7 +1497,7 @@ mlx5_rx_burst_mprq(void *dpdk_rxq, struct rte_mbuf **pkts, uint16_t pkts_n)
uint16_t strd_cnt;
uint16_t strd_idx;
uint32_t byte_cnt;
- uint16_t skip_cnt;
+ uint16_t skip_cnt = 0;
volatile struct mlx5_mini_cqe8 *mcqe = NULL;
enum mlx5_rqx_code rxq_code;
--
2.47.3
reply other threads:[~2026-05-15 12:34 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260515123358.354191-1-dsosnowski@nvidia.com \
--to=dsosnowski@nvidia.com \
--cc=akozyrev@nvidia.com \
--cc=bingz@nvidia.com \
--cc=dev@dpdk.org \
--cc=kiranv@nvidia.com \
--cc=matan@nvidia.com \
--cc=orika@nvidia.com \
--cc=stable@dpdk.org \
--cc=suanmingm@nvidia.com \
--cc=viacheslavo@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox